hello,
yesterday i installed my RPi3B+ server newly from a clean image an run into an issue while setting up an access point.
i installed the current Raspbian image (2018-11-13-raspbian-stretch.zip) to my SD card, added an SSH file to the boot partition, to have ssh enabled just after first reboot.

at the first reboot (after automatic resizing/growing filesystem pass) i could shortly see a message with something like that the WiFi was disables because of unsetted country code or something similar popping through the slpash-screen.

luckily i found exact the same issue in an issue report on github Failed to start hostapd.service: Unit hostapd.service is masked.,
and by coincidence the user XECDesign is just preparing an updated documentation for setting up an access point so the user XECDesign was so kind, to pointing me to the right commands to unmask the masked hostapd service.

but where is that issue coming from, that the WiFi is "locked down"?
i mean i setted up the WiFi country code in raspi-config, but WiFi wasn't unlocked automatically...

and i mean, that WiFi wasn't working at all out of the box - i couldn't see a network icon for WiFi on the screen/taskbar...
and on the welcome/configuration screen i mean the first time it shoed me a wrong IP address.
at installation and setup time the RPi3B+ was connected via LAN cable, and had an additional USB-LAN-adapter attached.

Wifi didn't start because Raspbian mandates a valid country code, otherwise rfkill blocks the interface.
Users can drop a wpa_supplicant.conf file in the boot partition, and that file normally provides the country code. For them, wifi "just works".
Otherwise you have to use raspi-config, and perhaps reboot afterwards (?)

Then you stumbled on an unrelated and recent issue. The debian maintainers have been updating the hostapd package, and that surprised a few Rasbian users in turn.viewtopic.php?f=66&t=235105#p1439522

Then you stumbled on an unrelated and recent issue. The debian maintainers have been updating the hostapd package, and that surprised a few Rasbian users in turn.viewtopic.php?f=66&t=235105#p1439522

yes, those kind of "wpa" and "tls" messages i could observe on my update/upgrade output as well.
but i can't remember if it was only on the frist try of installation (where i tried many different things to get WiFi working without success) or on both installation (where "i know how" to get WiFi working). i did a clean installation twice.
at first installation, i could set WiFi country code at first boot successfully, but after a reboot WiFi still wasn't working. then i tried it again to set the wifi country code, but then i got an error message in raspi-config, that wifi country code couldn't be setted, because raspi-config couldn't connect to the needed service. so the first try of clean installation of raspbian was a disaster.

i think at first clean installation i was doing sudo apt update && sudo apt full-upgrade -y before i setted the wifi country code.
at second clean installation i setted the wifi country code first and then did sudo apt update && sudo apt full-upgrade -y.